Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,758 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
968
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,645
658
432
53
30
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,828
3,376
1,979
1,616
1,042
CVEs
18
14
12
12
11
Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet)
Detects Windows shells and scripting applications that write files to suspicious folders
Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools
Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to copy registry hives that are in use)
Shadow Copies storage symbolic link creation using operating systems utilities
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
Detects potential registry persistence technique using the Event Viewer "Events.asp" technique
Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE
Check if the user that executed the commands is suspicious (e.g. service accounts, LOCAL_SYSTEM)
Check if the user that executed the commands is suspicious (e.g. service accounts, LOCAL_SYSTEM)
Psexec Execution
Sigma
Detects user accept agreement execution in psexec commandline
Detects suspicious launch of the PSEXESVC service on this system and a sub process run as LOCAL_SYSTEM (-s), which means that someone remotely started a command on this system running it with highest privileges and not only the privileges of the login user account (e.g. the administrator account)
Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privileges. This is often used after a privilege escalation attempt.
Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system
Detection well-known mimikatz command line arguments
Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disable' accounts or change the password...etc
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory
Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash
Detects the invocation of the Stored User Names and Passwords dialogue (Key Manager)
Detects suspicious use of XORDump process memory dumping utility
Detects execution of javascript code using "mshta.exe".
Page 463 of 465